Application Protocol Analytics GCDA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is reviewing HTTP traffic and notices a request with a URI that contains a long string of percent-encoded characters. The decoded string includes 'cmd.exe' and 'whoami'. The request is sent to a web server that hosts a file upload application. What is the most likely interpretation of this traffic?

   • AA normal file upload request with a filename that contains encoded characters.
   • BA SQL injection attempt using encoded characters to bypass filters.
   • CA cross-site scripting (XSS) attack that injects JavaScript into the page.
   • DAn attempt to exploit a command injection vulnerability in the web application.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are monitoring a DNS server and see a query for a domain that is longer than 255 characters, with an unusually high number of labels. What does this indicate?

   • AA malformed DNS query, possibly indicating a tunneling attempt.
   • BA DNS cache poisoning attempt.
   • CA DNS amplification attack.
   • DA normal DNS query for a long but valid domain.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A detection analyst is reviewing a PCAP and sees a flow to an external IP on TCP port 443. The analyst wants to determine if this is HTTPS traffic or some other protocol tunneled over port 443. Which observation would most strongly indicate that the traffic is NOT standard HTTPS?

   • AThe connection uses TLS 1.2 and the handshake completes successfully.
   • BThe first packet from the client is a TLS ClientHello with a list of standard cipher suites.
   • CThe traffic is encrypted and the analyst cannot see the application data.
   • DThe ClientHello is followed immediately by a ServerHello and certificate, but the certificate is self-signed and the server name indication (SNI) does not match the destination IP.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An analyst wants to determine which internal host is communicating with a known malicious external IP over HTTP. Which data is most directly useful for this correlation?

   • AThe source IP address in the HTTP session
   • BThe MAC address of the default gateway
   • CThe destination port of the HTTP response
   • DThe DNS server's IP address
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A detection analyst notices that a single internal host is sending DNS queries for many unique subdomains under a rarely used domain, with each query returning an NXDOMAIN response. The queries occur in bursts every few minutes. Which hypothesis is best supported by this pattern?

   • AThe host is experiencing a temporary DNS resolver outage.
   • BThe host is performing DNS-based data exfiltration or tunneling.
   • CThe host is running a legitimate dynamic DNS update client.
   • DThe host is infected with malware that is scanning for open DNS resolvers.
   Reveal Solution Discussion Select an answer first